Live › vulnerability › CVE-2026-117912
Go to dashboardA flaw in Firefox's CSS Parsing and Computation component breaks the same-origin policy, which keeps one website from reading another site's data. The sources do not say what data an attacker can reach or how reliably.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox builds older than the fixed versions, on desktop or in a deployment that ships Firefox. The sources do not say which configurations or content types trigger the flaw, so it is unknown whether a site that does not load untrusted content can skip the update.
No product ranges from the sources yet.
firefox --version159 or later115.44 or 153.6, or later on the matching branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117912")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.